CVE-2021-41184

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:

$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );

will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. A workaround is to not accept the value of the of option from untrusted sources.

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. A workaround is to not accept the value of the of option from untrusted sources.

TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.4-tuxcare.1.

TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.3-tuxcare.1.

This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:

Security fixes included on the update:

ardana-barbican:

• Update policies to protect container secret access (SOC-11621)
• Update policies to protect secret metadata access (SOC-11620)

openstack-neutron:

• CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).

rubygem-sinatra:

• CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).

python-XStatic-jquery-ui:

• CVE-2021-41182: Fixed XSS in the altField option of the Datepicker widget (bsc#1192070)
• CVE-2021-41183: Fixed XSS in the of option of the .position() util (bsc#1192073)
• CVE-2021-41184: Fixed XSS in *Text options of the Datepicker widget (bsc#1192075)

python-lxml:

• CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).
• CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).
• CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).
• CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).

openstack-barbican:

• CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).
• CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).

grafana:

• CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).

openstack-keystone:

• CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).

Non-security fixes included on the update:

Changes in ardana-barbican:

• Update to version 9.0+git.1644879908.8a641c1:

  • Update policies to protect container secret access (SOC-11621)

• Update to version 9.0+git.1643052417.9a3348e:

  • update policies to protect secret metadata access (SOC-11620)

Changes in grafana:

• Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)

  • directory traversal vulnerability for .md files

• Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)

  • Fix Go net/http: limit growth of header canonicalization cache

Changes in openstack-barbican:

• Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix the legacy policy rules for adding a secret to a container and removing a secret from a container. bsc#1194954,CVE-2022-23452

• Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the legacy policy rules for accessing secret metadata by checking that the user making the request is authenticated for the project that owns the secret. bsc#1194952,CVE-2022-23451

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-14.0.1.dev4:

  • Add support for yoga

• Update to version group-based-policy-automation-14.0.1.dev3:

  • Python2/3 compatibility fixes

• Update to version group-based-policy-automation-14.0.1.dev2:

  • Add support for xena

• Update to version group-based-policy-automation-14.0.1.dev1:

  • Remove py27 from gate jobs 14.0.0

Changes in openstack-horizon-plugin-gbp-ui:

• Update to version group-based-policy-ui-14.0.1.dev3:

  • Add support for yoga

• Update to version group-based-policy-ui-14.0.1.dev2:

  • Python2/3 compatibility changes

• Update to version group-based-policy-ui-14.0.1.dev1:

  • Add support for xena …

It was discovered that jQuery UI did not properly validate the values from untrusted sources. An attacker could use this vulnerability to cause a crash or possibly execute arbitrary code. This issue affected only Ubuntu 18.04 ESM and Ubuntu 20.4 ESM. (CVE-2021-41184)

It was discovered that jQuery UI checkboxradio widget did not properly decode certain values from HTML entities. An attacker could possibly use this issue to generate a cross-site scripting(XSS) attack, resulting in a crash or possibly execute arbitrary code. (CVE-2022-31160)

Hong Phat Ly discovered that jQuery UI did not properly manage parameters from untrusted sources, which could lead to arbitrary web script or HTML code injection. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-7103)

Esben Sparre Andreasen discovered that jQuery UI did not properly handle values from untrusted sources in the Datepicker widget. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-41182, CVE-2021-41183)

It was discovered that jQuery UI did not properly validate values from untrusted sources. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-41184)

It was discovered that the jQuery UI checkboxradio widget did not properly decode certain values from HTML entities. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack and cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-31160)